Isif

Mandiant #AdvancedPractices analyst.

[⚛️ Marcin Siedlarz @siedlmar]

🚨 New conference alert 🚨
Join us for RooCon, a free one-day conference on cyber threat intelligence and attribution.

The conference will be held at Google's offices in Sydney, Australia on Tuesday, 21st of November 2023.

[Isif @Isifmobile]

@TayaraRomero Dropping a pull on a clear, calm day.

[Christopher Glyer @cglyer]

Alternate hypothesis: independent developer who specializes in security impairment tools sells them to multiple actors like ELBRUS/FIN7 & DEV-0506 (Black Basta deployer)

Overlap in custom packer could be explained by ELBRUS “crypting” their malware/tools

https://t.co/IViuRPr7YO

[Isif @Isifmobile]

@stonepwn3000

[Isif @Isifmobile]

Sigh.

[Kieran Drew @ItsKieranDrew]

Do you sit at a computer for longer than 6 hours a day?

You’re destroying your body if so.

Here’s the setup you need to protect yourself from posture problems and crippling long-term injuries:

🧵

[Mandiant (part of Google Cloud) @Mandiant]

Don't miss the next installment of the Mandiant FLARE team's webinar series, The Sample. This week, Principal Reverse Engineer Blaine Stancill will explain the inner workings of a dropper from the #WHITEDAGGER malware family. Register now! https://t.co/ocDKpqnOLA

[Isif @Isifmobile]

@literallymecats

[Isif @Isifmobile]

@sam_micheals74 That’s where the initial access teams live.

[Isif @Isifmobile]

Found the source of all ransomware. Deploy the SWAT teams.

[Isif @Isifmobile]

@klrgrz Yes, super duper ultra high confidence as well.

[Isif @Isifmobile]

@BeerN_Loathing Sorry fren. Fair warning.

[Isif @Isifmobile]

@ImposeCost I’m Canadian so I try to be polite, but this is what I meant.

[Isif @Isifmobile]

And turn on logging, then look at the logs. All of them.

[Steve Elovitz @SElovitz]

When you don't yet have initial intrusion vector, avoid the temptation to assume insider/0day. Follow the evidence and prove it.

"It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts"

[Isif @Isifmobile]

@thinkpoison @AndrewCyberKop @nicastronaut @captainGeech42

[Isif @Isifmobile]

@thinkpoison Speak for yourself.

[Isif @Isifmobile]

@toobadulti Rhys Toogood? Nice try, you can’t just make up players.

[Isif @Isifmobile]

I wonder if the problem is DNS. 🤔

[Isif @Isifmobile]

@ChicagoCyber 😒

[bk (Ben Koehl) @bkMSFT]

Additional Command and Control IP's:
80.66.88[.]155
5.39.222[.]150
141.105.64[.]121
31.192.105[.]28
91.245.253[.]112
23.106.123[.]119

Timely blog @proofpoint team

[Isif @Isifmobile]

@DavidSug @Popehat